CVE-2020-10857: Critical severity zulip Zulip Desktop vulnerability
Published Feb 5, 2021
·Updated
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution.
Affected Software
1 affected component
zulip Zulip Desktop<5.0.0
Event History
Feb 5, 2021
CVE Published
via MITRE·07:16 PM
Data Sourced
via MITRE·07:16 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-10857?
The severity of CVE-2020-10857 is critical, with a CVSS score of 9.8.
2
How does CVE-2020-10857 lead to remote code execution?
CVE-2020-10857 leads to remote code execution by improperly using shell.openExternal and shell.openItem functions with untrusted content.
3
Which software versions are affected by CVE-2020-10857?
Zulip Desktop versions up to but excluding 5.0.0 are affected by CVE-2020-10857.
4
How can I fix CVE-2020-10857?
To fix CVE-2020-10857, update your Zulip Desktop software to version 5.0.0 or higher.
5
Where can I find more information about CVE-2020-10857?
More information about CVE-2020-10857 can be found at the following link: [https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/](https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/)